ASUS Aptio 5 Intel ME disable with me_cleaner.py guide

Discussion in 'BIOS Mods' started by trixeo, Feb 2, 2018.

  1. trixeo

    trixeo MDL Novice

    Jan 23, 2009
    2
    2
    0
    #1 trixeo, Feb 2, 2018
    Last edited: Feb 4, 2018
    Sorry for this but I spoke too soon :( Following this guide will do nothing because ME part in UEFI will not be updated. I even bricked my mobo experimenting further, flashback does not help and the only way would be to get the bios chip flashed outside of mobo. I ordered a brand new x99a instead and will not pursue this issue until someone else comes up with a safe solution.

    Hi, I wrote this guide for myself but felt that maybe someone else can make use of it. My motherboard is a ASUS X99-A and as far as I can tell I no longer have a working Intel ME after following the following steps =) Spectre and Meldown in all glory but Intel ME is for me a much greater concern. I also successfully added Intel Microcode (Intel Core i7-5930K Haswell-E/EP 306F2:3B) with UBU to mitigate Spectre successfully in another guide but my computer was noticeably slower and behaved strangely in some situations, for instance in Windows 10 1709 with all patches applied and my ASUS Radeon RX 480 changing resolutions and or displays took up to 30 seconds with black screens and a lot of flickering, if not a BSOD with black screen and no text so I removed that Microcode. This Intel ME me_cleaner guide however works flawlessly so far =) This guide is only for the daring, and know this: your computer might brick if you do this improperly and the warranty will be void. Good luck!

    1. Download and install Python 2.7.x: www*python.org/downloads/
    2. Download me_cleaner.py: github*com/corna/me_cleaner and put it in your Python root dir C:\Python27\
    3. Download UBU: www*win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html and extract it to C:\UBU\
    4. Download a copy of your motherboards latest bios and extract it to your UBU folder.
    5. Run UBU.bat
    6. When UBU has finished getting info from your bios while UBU is still running with the options menu shown, move the bios.bin found in your UBU folder to C:\Python27\ (do not exit UBU yet)
    7. Check if your bios is compatible with me_cleaner:
    - Open CMD with admin privileges and cd to your Python dir, type:
    Code:
    cd c:\python27
    and then:
    Code:
    python.exe me_cleaner.py -c bios.bin
    it should say something like this:
    Code:
    Full image detected
    The ME/TXE region goes from 0x3000 to 0x180000
    Found FPT header at 0x3010
    Found 20 partition(s)
    Found FTPR header: FTPR partition spans from 0x47000 to 0xcf000
    ME/TXE firmware version 9.1.37.1002
    Public key match: Intel ME, firmware versions 9.0.x.x, 9.1.x.x
    Checking the FTPR RSA signature... VALID
    8. Run me_cleaner on your bios:
    - Type:
    Code:
    python.exe me_cleaner.py -S -O bios.bin.mod bios.bin
    9. If no error messages were shown, you now have a cleaned bios named bios.bin.mod in C:\Python27
    10. Move the file bios.bin.mod to C:\UBU and rename it bios.bin
    11. Exit UBU with 0 and then select "1 - Rename to ASUS USB BIOS Flashback"
    12. You will now have a .cap file that you can flash with ASUS USB BIOS Flashback that is cleaned from Intel ME.

    Please comment with success or failure and what motherboard/CPU you have.
    Question: Should I remove (uninstall the drivers) or disable the Intel ME device in Device Manager?
    Also: What is the purpose and security concerns of ASUS Probe II Sense Drivers (AXSP/ATKEX, Io/AsIO64)? I am not using any ASUS programs at all and will not overclock my motherboard.
     
  2. trixeo

    trixeo MDL Novice

    Jan 23, 2009
    2
    2
    0
    UPDATE: Since I wrote this guide and managed to corrupt my BIOS I have now bought a new X99-A. I took the bios chip (winbond 25Q128FVIQ) from the new mb and put it on my old mb. Guess what? It booted and works! Though Windows 10 now says that my Windows installation is not activated anymore. I guess that is because the new bios chip has a different serial and or a different MAC adress. The most curios thing though is that my Intel ME device is gone from the Device Manager and meinfo gives me Error 9470. My computer does not reboot after 30 minutes so I guess I managed to get rid of despicable ME after all =) I am now waiting for a ch341a that I will use to try to salvage my old bios chip with. And hopefully get the UUID and MAC to match what Windows thinks is the same computer as before this mess.

    But WHY is the Intel ME disabled with the new BIOS chip??? I don't get it, is it like there is somewhere else on the mainboard that this info is stored? In the Northbridge? Of course I both removed the battery and cleared CMOS with power cut, both before and after changing chips. I am not 100% sure exactly what I did to the modified bios that made it go corrupt and refused to even get to the POST, computer died after less than a second on cold start and kept repeating trying to start until I cut the power to it. I used both me_cleaner and AMIBCP (to try to unlock RTC and BIOS lock, host and gbe lock-down) and lastly UBU to correct checksum and re-CAP it before I used Flashback to flash it. That was the end. So now with the new bios chip, my motherboard still remembers what I did to it? Where???
     
  3. THEBOSS619

    THEBOSS619 MDL Novice

    Sep 20, 2017
    4
    3
    0
    I think it has a separate module or part on your old mobo which still remembers your action :)

    check this link---> http(*)://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html

    Remove the (*) :)

    To save your time:-

    Intel Management Engine Introduction: Built into many Intel-based platforms is a small, low power computer subsystem called the Intel Management Engine (Intel ME). This can perform various tasks while the system is booting, running or sleeping. It operates independently from the main CPU, BIOS & OS but can interact with them if needed. The ME is responsible for many parts of an Intel-based system. Such functionality extends, but it's not limited, to Platform Clocks Control (ICC), Thermal Monitoring, Fan Control, Power Management, Overclocking, Silicon Workaround (resolves silicon bugs which would have otherwise required a new cpu stepping), Identity Protection Technology, Boot Guard, Rapid Start Technology, Smart Connect Technology, Sensor Hub Controller (ISHC), Active Management Technology (AMT), Small Business Advantage (SBA), Wireless Display, PlayReady, Protected Video/Audio Path etc. For certain advanced/corporate features (AMT, SBA etc) the ME uses an out-of-band (OOB) network interface to perform functions even when the system is powered down, the OS and/or hard drivers are non-functional etc. Thus it is essential for it to be operational in order for the platform to be working properly, no matter if the advanced/corporate features are available or not.